Learning objectives

• Explain How Websites Work the way a junior AppSec engineer would
• Map the idea to login, checkout, or API flows you already use
• Know a safe lab way to observe the issue (Juice Shop / CYNARKS Labs)
• Pass the knowledge check without attacking real sites

1. In one sentence

A website is your browser (client) talking to a server over HTTP/HTTPS — with trust boundaries in between.

2. Why it matters (daily life)

Every Gmail click, Instagram scroll, and Razorpay pay button is this conversation. If you don’t know who trusts whom, you can’t spot where attacks live.

3. How it works

1. Browser requests a URL.
2. DNS finds the server.
3. TLS (HTTPS) protects the pipe.
4. Server runs app + DB logic.
5. HTML/JS/CSS return to you. Trust boundary: your device ↔ internet ↔ app ↔ database.

4. Real-world / authorized lab example

College portal: browser → HTTPS → app server → marks database. Attackers aim at weak spots on that path (auth, IDOR, injection) — you learn them in labs.

5. Fix mindset (builders)

Prefer input validation, parameterized queries / safe APIs, least-privilege sessions, security headers, and regression tests. “Patch later” is how IDOR and XSS become incidents.

6. Common mistakes

Thinking “the website is one magic box”; ignoring HTTPS; testing prod blindly.

7. Practical habit (authorized labs only)

1. Reproduce on an intentional vulnerable app in Labs.
2. Capture request/response notes (redact secrets).
3. Write the fix in one paragraph a developer can ship.
4. Retest after the fix — same steps, expect fail-closed.

8. Memory tip

Explain this using Gmail login, Instagram, PhonePe checkout, or a college portal — as a story, without attacking real sites.

Practice intercepts only on authorized lab apps (e.g. Juice Shop in Labs).

Knowledge Check

Q1. What is the client?

A. Test only on authorized lab apps and report clear remediations
B. Probe live banking / college sites without written permission
C. Ignore HTTPS and mishandle sessions on purpose in production
D. Disable logging so findings cannot be traced

Q2. What does TLS mainly protect?

A. Test only on authorized lab apps and report clear remediations
B. Probe live banking / college sites without written permission
C. Ignore HTTPS and mishandle sessions on purpose in production
D. Disable logging so findings cannot be traced

Q3. Name one trust boundary.?

A. Test only on authorized lab apps and report clear remediations
B. Probe live banking / college sites without written permission
C. Ignore HTTPS and mishandle sessions on purpose in production
D. Disable logging so findings cannot be traced

Answer Key

1. A
2. A
3. A

Lesson Summary

How Websites Work is a building block of modern web risk. Learn it deeply; practice only where you are allowed.

Coming next

Continue the Web Application Security syllabus. Keep your proxy pointed at lab targets only.

CYNARKS Academy – Learn to Understand. Practice to Defend.
Never test live PhonePe, Instagram, Razorpay merchant panels, or college portals without written permission.